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Amendments to the Claims 

1 . (currently amended) A method of generating encrypted packets comprising the 
steps of: 

receivings in a security processor, a first Ethernet packet from an 
originating device, the first Ethernet packet comprising a second Ethernet packet and a 
memory address associated with a security association , wherein a destination address of 
the second Ethernet packet is an address of the originating device ; 

extracting the memory address and the second Ethernet packet from the 
first Ethernet packet; 

retrieving the security association from the memory using the received 
memory address; and 

encrypting a portion of the extracted second Ethernet packet according to 
the retrieved security association. 

2. (previously presented) The method of claim 1 wherein the first Ethernet 
packet also includes outer Ethernet header and a manufacturer header. 

3. (previously presented) The method of claim 2 wherein the manufacturer 
header includes the memory address. 

4. (previously presented) The method of claim 3 wherein the outer Ethernet 
header comprises an Ethernet address of the security processor. 

5. (currently amended) The method of claim 4 wherein the outer Ethernet header 
comprises a user-specific type fi e ld . 
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6. (previously presented) The method of claim 5 wherein a first byte of the 
manufacturer header is set to zero. 

7. (previously presented) The method of claim 6 wherein a portion of the 
manufacturer header following the first byte of the manufacturer header includes the 
memory address. 

8. (canceled) 

9. (previously presented) The method of claim 1 wherein the extracting step 
comprises determining whether an Ethernet type field from the first Ethernet packet 
comprises a user-specific Ethernet type. 

10-12. (canceled) 

13. (previously presented) The method of claim 1 wherein the retrieving step 
comprises retrieving the at least one security association from a memory in the security 
processor. 

14. (previously presented) The method of claim 1 wherein the encrypting step 
comprises using an encryption key associated with the security association. 

15. (previously presented) The method of claim 1 wherein the encrypting step 
comprises using an encryption algorithm defined by the security association. 
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16. (previously presented) The method of claim 1 wherein the extracting step 
comprises determining whether an Ethernet address from the first Ethernet packet 
matches an Ethernet address of the security processor. 

17. (currently amended) A method of generating encrypted packets by processing 
at a security processor a first Ethernet packet from an originating device, the first Ethernet 
packet comprising a second Ethernet packet having a header pre-populated with an 
address of the originating device as the destination address, and the first Ethernet packet 
further comprising a memory address associated with a security association, the method 
comprising the steps of: 

extracting the memory address and the second Ethernet packet from the 
first Ethernet packet; 

retrieving the security association from the memory using the extracted 
memory address; and 

encrypting a portion of the packet data of the extracted second Ethernet 
packet according to the retrieved security associatio n; and 

returning the second Ethernet packet to the originating device, wherein the 
returned second Ethernet packet includes the pre-populated header and the encrypted 
packet data . 

18. (previously presented) The method of claim 17 wherein the extracting step 
comprises determining whether an Ethernet type field from the first Ethernet packet 
comprises a user-specific Ethernet type. 
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19. (previously presented) The method of claim 17 wherein the extracting step 
comprises determining whether a first byte following an Ethernet type field from the first 
Ethernet packet is set to a zero. 

20. (previously presented) The method of claim 17 wherein the extracting step 
comprises extracting an address from second, third and fourth bytes following an Ethernet 
type field from the first Ethernet packet. 

21. (previously presented) The method of claim 17 wherein the extracting step 
comprises extracting an address from a lower 22 bits of second, third and fourth bytes 
following an Ethernet type field from the first Ethernet packet. 

22. (previously presented) The method of claim 17 wherein the retrieving step 
comprises retrieving the security association from a memory in a security processor. 

23. (previously presented) The method of claim 17 wherein the encrypting step 
comprises using an encryption key associated with the security association. 

24. (previously presented) The method of claim 1 7 wherein the encrypting step 
comprises using an encryption algorithm defined by the security association. 

25. (previously presented) The method of claim 17 wherein the extracting step 
comprises determining whether an Ethernet address from the first Ethernet packet 
matches an Ethernet address of a security processor. 
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26. (currently amended) A method of generating packets, at an originating 
device, to be encrypted by a security processor comprising the steps of: 

generating a first Ethernet packet , wherein the first Ethernet packet 
includes a header having an address of the originating device as the destination address 
and packet data ; 

associating a security association with the first Ethernet packet; 

identifying a memory address associated with the security association; and 

generating a second Ethernet packet encapsulating the memory address 
and the first Ethernet packet, wherein the second Ethernet packet includes a header 
having an address of the security processor as the destination address, 

wherein a portion of the packet data of the generated first Ethernet packet 
is crypto graphically processed by the security processor and the portion of the packet data 
is replaced with the crypto graphically processed data when the first Ethernet packet is 
returned to the originating device . 

27. (previously presented) The method of claim 26 wherein the generating a 
second Ethernet packet comprises generating an outer Ethernet header comprising an 
address of a security processor. 

28. (previously presented) The method of claim 26 wherein the generating a 
second Ethernet packet comprises generating an outer Ethernet header and a manufacturer 
header. 

29. (original) The method of claim 28 wherein the outer Ethernet header 
comprises an Ethernet address of a security processor. 
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30. (currently amended) The method of claim 28 wherein the outer Ethernet 
header comprises a user-specified Ethernet type field. 

31. (previously presented) The method of claim 28 wherein the manufacturer 
header comprises the memory address. 

32. (previously presented) The method of claim 28 wherein a first byte of the 
manufacturer header is set to zero. 

33. (previously presented) The method of claim 28 wherein second, third and 
fourth bytes of the manufacturer header comprise the memory address. 

34. (canceled) 

35. (previously presented) The method of claim 26 further comprising the steps 

of: 

receiving data to be sent over an Ethernet network; and 
incorporating the data into the first Ethernet packet. 

36. (previously presented) The method of claim 26 further comprising the step of 
transmitting the second Ethernet packet to at least one security processor. 

37. (currently amended) A security processor for generating encrypted packets by 
processing a first Ethernet packet received from an originating device, the first Ethernet 
packet comprising a second Ethernet packet including a header having an address of the 
originating device as the destination address and a memory address associated with a 
security association, comprising: 
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a memory for storing the security association; 

a Gigabit MAC for receiving the first Ethernet packet; 

a processor, connected to receive at least a portion of the first Ethernet 
packet from the Gigabit MAC, for 

extracting the memory address from the first Ethernet packet; and 
retrieving the security association from the memory using the 
extracted memory address; and 

an encryption processor, connected to the processor, for encrypting at least 
a portion of the second Ethernet packet according to the retrieved security association; 
and 

a unit configured to transmit the second Ethernet packet, including the at 
least a portion encrypted by the encryption processor, to the originating device . 

38. (previously presented) The security processor of claim 37 wherein the first 
Ethernet packet comprises an outer Ethernet header and a manufacturer header including 
the memory address. 

39. (previously presented) The security processor of claim 37 wherein the 
encryption processor comprises a EPsec processor. 

40. (original) The security processor of claim 37 wherein the security processor is 
an integrated circuit. 

41-53. (canceled) 



